I'm looking at the architecture of Android and want to come up with a service that allows for multiple applications (3rd party) to call a local android service and fetch data. Think of this as a partitioned dropbox service, where each app saves a file, and if the user configures the app to share data between apps (e.g. photos between app1 and app2) then it's permitted.
Are you aware of any API that will allow me to securely validate the calling application so they they are the only ones that can access their store?
I’m thinking about identifying the calling EXE, and checking that hash but that won't work if the app is updated.
Potentially each app is signed by the same key so I can use that as a unique app-identifying constant.
My main concern is someone gaining binary access to app #1, extracting a key or identifier, an using that to spoof access to my Android Service.
Any alternate solutions are welcome